The
CJEU reaffirms the individual’s right to privacy and outlines the necessarily
stringent thresholds necessary to ensure that the retention of data remains “justified within a democratic society”. In
regards to DRIPA, this threshold was not met: “National legislation such as
that at issue in the main proceedings therefore exceeds the limits of what is
strictly necessary and cannot be considered to be justified, within a
democratic society”.

The
ruling offers a stark rebuttal to the government’s justification for DRIPA and
by implication the IP Act, which codifies a great deal of powers that
indiscriminately retain data on UK citizens. This includes measures that
collect data on the many to find the few, an approach that is undermined by the
ruling’s position that “the retention of data is limited, with respect to the
categories of data to be retained, the means of communication affected, the
persons concerned and the retention period adopted, to what is strictly
necessary”.

Moving
beyond these thresholds, the ruling also raises questions about the
government’s stipulation that metadata is less sensitive than content data, a
belief that led the then-Home Secretary, Theresa May to
state, though never repeat, that Internet Connection Records, are “simply the
modern equivalent of an itemised phone bill”. Quoting the Advocate General, the
ruling states: “in particular, that data provides the means…of establishing a
profile of the individuals concerned, information that is no less sensitive,
having regard to the right to privacy, than the actual content of
communications.”

While
this can only be used to present potential implications for the IP Act, as it currently
stands, a great number of powers in the bill are effectively unlawful and
require change. But in the ongoing tumult around our relationship with Europe
following the Brexit vote, it is vital that this ruling is given due attention
and scrutiny to ensure that our laws adhere to established and tested human
rights protections written into EU law, without it being ignored as a ruling
from a different time.

As
highlighted by the ruling, “the interference entailed by such legislation in
the fundamental rights enshrined in Articles 7 and 8 of the Charter is very
far-reaching and must be considered to be particularly serious.” This
seriousness cannot be drowned out by the partisan arguments that are shaping
our negotiating stance on Brexit. The implications of suspicionless
surveillance on the right to privacy and freedom of expression cannot be
downplayed nor should they be deployed as a pawn in the debate about our
relationship with Europe.

If our future lies
outside the European Union, it should not exist in a bubble only of our own
making. A number of vital rulings in the European Court of Human Rights,
statements from the UN Special Rapporteur on the Right to Privacy and now the CJEU have all highlighted
distinct issues with suspicionless surveillance as outlined in both DRIPA and
the IP Act that cannot be ignored. Our strength as a nation, as a leading
modern democracy, rests on our ability to listen to others, scrutinise without
prejudice and advocate for what is best for our democracy, not necessarily our
politics.

About the author

Nik Williams is the
policy advisor for Scottish PEN, the Scottish centre of PEN International. We
are leading the campaign opposing suspicionless surveillance and protecting the
rights of writers both in Scotland and across the globe. Find out more on Twitter
at @scottishpen and @nikwilliams2.

This article is published under a Creative Commons Attribution-NonCommercial 4.0 International licence.
If you have any queries about republishing please contact us.
Please check individual images for licensing details.

Do you care about online rights? digitaLiberties needs your support to keep publishing alternative perspectives on surveillance, net neutrality and privacy. Please help by donating whatever you can.